Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8226649

NullPointerException (boundValues) in SSLSessionImpl methods since JDK-8211018

    XMLWordPrintable

    Details

      Description

      A DESCRIPTION OF THE PROBLEM :
      JDK-8211018 / c2398053ee90 introduced a new SSLSessionImpl constructor that initializes the final variable "boundValues" to null ... but none of the existing code in that class that references boundValues guards against the possibiility of this variable being null, resulting in NullPointerExceptions from methods such as getValue, putValue, getValueNames(), etc..

      This manifests in Apache Solr testing (using jetty 9.4.19.v20190610) as...

      java.lang.NullPointerException
      at java.base/sun.security.ssl.SSLSessionImpl.getValue(SSLSessionImpl.java:1253)
      at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:230)
      at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:170)
      at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:363)
      at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267)
      at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
      at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
      at org.eclipse.jetty.io.ssl.SslConnection$1.run(SslConnection.java:144)
      at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:781)
      at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:917)
      at java.base/java.lang.Thread.run(Thread.java:830)

      NOTE: I am not an SSL expert, and do not pretend to grasp the motivation behind JDK-8211018 -- based on the description of that issue it's certainly possible that it's entirely intentional that boundValues = null in these code paths, and that the getValues/setValues/etc methods should not be used in these circustances -- but even if that is true it seems like the methods need to be updated to include null checks and throw something like IllegalStateException

      http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java
      http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java

      REGRESSION : Last worked in version 13


      FREQUENCY : always


        Attachments

          Issue Links

            Activity

              People

              Assignee:
              ascarpino Anthony Scarpino
              Reporter:
              webbuggrp Webbug Group
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: